Huh? It hashes the binary and phones home doesn’t it? Go compile anything with gcc and watch that it takes one extra second for the first run of that executable. It’s not verifying any certificates
Nope.
It has a built in malware scanner, but that just requires a downloaded list of known malware signatures.